A chemical plant is conducting a business impact analysis. The plant manager insists that the batch reactor control system must have an RTO of 30 minutes and an RPO of zero, because any downtime or data loss would be unacceptable. However, the current infrastructure cannot support such aggressive targets without significant investment. What is the most appropriate action?

Set the RTO/RPO based on the current infrastructure capabilities.

Challenge the RTO/RPO by quantifying the actual business impact and exploring cost-effective alternatives.

Ignore the RTO/RPO because they are not achievable.

Accept the RTO/RPO as stated and allocate the necessary budget for a hot site.

A large utility is evaluating disaster recovery strategies for its OT environment. The BIA shows that the most critical system has an RTO of 1 hour and an RPO of 5 minutes. The utility has a limited budget and cannot afford a dedicated hot site. Which recovery strategy is most appropriate?

Cold site with vendor-provided equipment delivered within 24 hours.

Cloud-based disaster recovery with pre-configured virtual machines and continuous replication.

Warm site with daily backups and standby hardware.

Manual failover to a backup control room with no automation.

When selecting a recovery strategy, what two factors must be balanced according to the risk-based approach?

Number of employees and office space

Hardware vendor and software licensing

Data backup frequency and storage capacity

Speed of recovery and cost of the strategy

A chemical plant's business impact analysis identified that the Distributed Control System (DCS) historian must be recoverable within 4 hours (RTO) with no more than 15 minutes of data loss (RPO). The plant's current backup solution writes historian data to tape nightly and stores the tapes offsite. During a recent risk assessment, the plant manager asked whether the current backup strategy meets the RTO and RPO. What is the most appropriate recommendation?

Switch to weekly full backups with daily incremental backups to reduce storage costs while maintaining the RPO.

Implement continuous data replication to an offsite location and test restoration procedures to meet the 15-minute RPO and 4-hour RTO.

Continue with nightly tape backups because they satisfy the RPO of 15 minutes.

Accept the current RPO because the historian is not a safety-critical system and recovery time is more important.

GIAC Global Industrial Cyber Security Professional

Domain 3Objective 3

Risk Based Disaster Recovery & Incident Response GICSP Practice Questions (Page 1)

Part of the Security Management and Response domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

10concepts

Questions 1–5

1expert · hard
A chemical plant is conducting a business impact analysis. The plant manager insists that the batch reactor control system must have an RTO of 30 minutes and an RPO of zero, because any downtime or data loss would be unacceptable. However, the current infrastructure cannot support such aggressive targets without significant investment. What is the most appropriate action?
Select an answer first
2expert · hard
A large utility is evaluating disaster recovery strategies for its OT environment. The BIA shows that the most critical system has an RTO of 1 hour and an RPO of 5 minutes. The utility has a limited budget and cannot afford a dedicated hot site. Which recovery strategy is most appropriate?
Select an answer first
3foundation · easy
Which type of exercise involves a discussion-based walkthrough of a scenario without actually executing the plan?
Select an answer first
4foundation · easy
When selecting a recovery strategy, what two factors must be balanced according to the risk-based approach?
Select an answer first
5application · medium
A chemical plant's business impact analysis identified that the Distributed Control System (DCS) historian must be recoverable within 4 hours (RTO) with no more than 15 minutes of data loss (RPO). The plant's current backup solution writes historian data to tape nightly and stores the tapes offsite. During a recent risk assessment, the plant manager asked whether the current backup strategy meets the RTO and RPO. What is the most appropriate recommendation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GICSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GICSP” is a trademark of its owner, used for identification only.

Risk Based Disaster Recovery & Incident Response GICSP Practice Questions (Page 1)

Questions 1–5

A large utility is evaluating disaster recovery strategies for its OT environment. The BIA shows that the most critical system has an RTO of 1 hour and an RPO of 5 minutes. The utility has a limited budget and cannot afford a dedicated hot site. Which recovery strategy is most appropriate?

Which type of exercise involves a discussion-based walkthrough of a scenario without actually executing the plan?

When selecting a recovery strategy, what two factors must be balanced according to the risk-based approach?

Keep studying — Security Management and Response